Third-Party Dependencies

Third-party dependencies are external libraries, frameworks, and software components that organizations integrate into their AI systems and applications rather than building them in-house. Managing these dependencies is critical for AI governance because they introduce supply chain risks, security vulnerabilities, and compliance challenges that enterprises must track and mitigate. Organizations need visibility into which third-party components power their AI models and applications, along with processes for vetting vendors, monitoring for security updates, and ensuring compliance with data protection and licensing requirements.

1 item

ResearchGlobal2026-08-12

LiteLLM Supply Chain Attack Hit 2,500 Orgs Through Malicious PyPI Packages

Researchers at CloudSEK confirmed that two malicious versions of LiteLLM, a widely used AI proxy library, were published to PyPI and exfiltrated AI provider keys, cloud credentials, SSH keys, and runtime secrets from over 2,500 organizations. The attack cascaded from a prior compromise of Aqua Security's Trivy scanner and exposed approximately 434,000 CI/CD pipelines during a 40-minute window. CloudSEK concludes that AI infrastructure has become a high-value attack target, and that open-source AI dependency management is a critical unaddressed gap in most enterprise supply chain security programs.

supply chain security LiteLLM PyPI credential exposure AI infrastructure risk third-party dependencies CI/CD security CloudSEK